Authenticate with a seeded operator key; fold escalation and switches into TerdutTeam

Credentials: the TerdutServer controller generates <name>-operator-key in the server's own namespace (owned by it) and hands it to the pods as TERDUT_OPERATOR_KEY; the server creates its instance-scoped account from it at every start. A replaced Secret rolls the pods. The bootstrap handshake, the checkpoint Secret, per-team service accounts and credentials Secrets, BootstrapStateLost and credentials.deletionPolicy are gone. CRDs: TerdutServer, TerdutTeam and TerdutAlertSource. TerdutEscalationRule and TerdutDeadmanSwitch become spec.escalation and spec.deadmanSwitches[] on the team (matched by name, extras removed); team invites are removed. A team is created under the identity <namespace>/<name> (external_id), so a retry, a lost status or a deleted team heal by repeating the same call, and a display name owned by another team is TeamNameTaken instead of an adoption. The server resolves escalation usernames (UnknownUser condition). OIDC claim names and trustEmail are spec fields. Fixes: query values are URL-escaped; every delete treats 404 as success; deleting a team no longer depends on allowedTeams consent; a switch or integration deleted on the server is recreated; unnamed switches take the CR's name. Cleanup: scaffold e2e test, AGENTS.md, devcontainer, unused config/ pieces and Client.Version() removed; DESIGN.md, README, ROADMAP and the demo (run-demo.sh, manifests) rewritten for the new design. Secret RBAC stays cluster-wide, now stated in DESIGN.md section 9. Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN
2026-10-09 14:56:22 +02:00
parent b0a431f2a4
commit e1103f2b7d
92 changed files with 2082 additions and 7561 deletions
@@ -2,9 +2,7 @@ package controller

 import (
 	"context"
-	"fmt"
 	"net/http/httptest"
-	"time"

 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
@@ -18,6 +16,12 @@ import (
 	"git.ryuvia.com/niklas/terdut-operator/internal/tdclient"
 )

+// platformName is the display name most specs give their team.
+const platformName = "platform"
+
+// allNamespaces is allowedTeams.namespaces.from admitting every namespace.
+const allNamespaces = "All"
+
 var _ = Describe("TerdutTeam Controller", func() {
 	const operatorNamespace = "default"

@@ -34,13 +38,12 @@ var _ = Describe("TerdutTeam Controller", func() {
 		fake, fakeSrv = newFakeTerdutServer()
 		DeferCleanup(fakeSrv.Close)

-		srv = bootstrapReadyTerdutServer(ctx, uniqueName("ttserver"), fakeSrv.URL)
+		srv = readyTerdutServer(ctx, uniqueName("ttserver"))

 		reconciler = &TerdutTeamReconciler{
-			Client:            k8sClient,
-			Scheme:            k8sClient.Scheme(),
-			OperatorNamespace: operatorNamespace,
-			NewClient:         func(string) *tdclient.Client { return tdclient.New(fakeSrv.URL) },
+			Client:    k8sClient,
+			Scheme:    k8sClient.Scheme(),
+			NewClient: func(string) *tdclient.Client { return tdclient.New(fakeSrv.URL) },
 		}
 		teamName = uniqueName("team")
 		teamKey = types.NamespacedName{Name: teamName, Namespace: operatorNamespace}
@@ -53,13 +56,7 @@ var _ = Describe("TerdutTeam Controller", func() {
 			_ = k8sClient.Update(ctx, team)
 			_ = k8sClient.Delete(ctx, team)
 		}
-		_ = k8sClient.Delete(ctx, &corev1.Secret{ObjectMeta: metav1.ObjectMeta{
-			Name: fmt.Sprintf("%s.%s-team-credentials", operatorNamespace, teamName), Namespace: operatorNamespace,
-		}})

-		// The TerdutServer bootstrapReadyTerdutServer created in BeforeEach
-		// carries its own finalizer; clear it directly the same way, rather
-		// than relying on TerdutServerReconciler to ever run again here.
 		srvKey := types.NamespacedName{Name: srv.Name, Namespace: operatorNamespace}
 		if err := k8sClient.Get(ctx, srvKey, srv); err == nil {
 			srv.Finalizers = nil
@@ -67,7 +64,7 @@ var _ = Describe("TerdutTeam Controller", func() {
 			_ = k8sClient.Delete(ctx, srv)
 		}
 		_ = k8sClient.Delete(ctx, &corev1.Secret{ObjectMeta: metav1.ObjectMeta{
-			Name: fmt.Sprintf("%s.%s-instance-credentials", operatorNamespace, srv.Name), Namespace: operatorNamespace,
+			Name: srv.Name + "-operator-key", Namespace: operatorNamespace,
 		}})
 	})

@@ -96,39 +93,56 @@ var _ = Describe("TerdutTeam Controller", func() {
 		return terdutv1alpha1.TerdutServerRef{Name: srv.Name}
 	}

+	getTeam := func(ctx context.Context) *terdutv1alpha1.TerdutTeam {
+		team := &terdutv1alpha1.TerdutTeam{}
+		Expect(k8sClient.Get(ctx, teamKey, team)).To(Succeed())
+		return team
+	}
+
+	// reconcileToReady drives a freshly created team through the finalizer pass
+	// and one apply pass.
+	reconcileToReady := func(ctx context.Context) {
+		reconcileOnce(ctx) // finalizer
+		reconcileOnce(ctx) // apply
+	}
+
 	Describe("the happy path", func() {
-		It("creates the team, mints its credential, and applies rename/oidc-groups", func(ctx SpecContext) {
-			createTeam(ctx, "platform", sameNSRef())
-			reconcileOnce(ctx) // finalizer
-			reconcileOnce(ctx) // full create+mint+apply
+		It("creates the team under its CR identity with the operator key, and applies oidc groups", func(ctx SpecContext) {
+			// The fake only answers a request carrying the server's operator key.
+			var keySecret corev1.Secret
+			Expect(k8sClient.Get(ctx, types.NamespacedName{Name: srv.Name + "-operator-key", Namespace: operatorNamespace}, &keySecret)).To(Succeed())
+			fake.expectKey = string(keySecret.Data[operatorKeyDataKey])
+
+			team := &terdutv1alpha1.TerdutTeam{
+				ObjectMeta: metav1.ObjectMeta{Name: teamName, Namespace: operatorNamespace},
+				Spec: terdutv1alpha1.TerdutTeamSpec{
+					ServerRef: sameNSRef(), DisplayName: platformName,
+					OIDC: terdutv1alpha1.TerdutTeamOIDC{MemberGroup: "members", OwnerGroup: "owners"},
+				},
+			}
+			Expect(k8sClient.Create(ctx, team)).To(Succeed())
+			reconcileToReady(ctx)

 			cond := readyCondition(ctx)
 			Expect(cond.Status).To(Equal(metav1.ConditionTrue))
 			Expect(cond.Reason).To(Equal(terdutv1alpha1.ReasonTeamAdopted))

-			team := &terdutv1alpha1.TerdutTeam{}
-			Expect(k8sClient.Get(ctx, teamKey, team)).To(Succeed())
-			Expect(team.Status.TeamID).To(Equal(fake.teams["platform"]))
-			Expect(team.Status.CredentialsSecretRef).NotTo(BeNil())
-
-			var credsSecret corev1.Secret
-			Expect(k8sClient.Get(ctx, types.NamespacedName{
-				Name: team.Status.CredentialsSecretRef.Name, Namespace: operatorNamespace,
-			}, &credsSecret)).To(Succeed())
-			Expect(credsSecret.Data[credentialsSecretDataKey]).NotTo(BeEmpty())
+			team = getTeam(ctx)
+			Expect(team.Status.TeamID).To(Equal(fake.teams[platformName]))
+			Expect(fake.teamExt).To(HaveKeyWithValue(operatorNamespace+"/"+teamName, team.Status.TeamID))
+			Expect(fake.teamOIDC[team.Status.TeamID]).To(Equal([2]string{"members", "owners"}))
 		})
 	})

 	Describe("waiting on the referenced TerdutServer", func() {
 		It("reports ServerRefNotFound when the TerdutServer doesn't exist", func(ctx SpecContext) {
 			createTeam(ctx, "orphan", terdutv1alpha1.TerdutServerRef{Name: testRefNotFoundName})
-			reconcileOnce(ctx) // finalizer
-			reconcileOnce(ctx)
+			reconcileToReady(ctx)

 			Expect(readyCondition(ctx).Reason).To(Equal(terdutv1alpha1.ReasonServerRefNotFound))
 		})

-		It("reports WaitingForServer when the TerdutServer exists but isn't Bootstrapped yet", func(ctx SpecContext) {
+		It("reports WaitingForServer when the TerdutServer exists but isn't Ready yet", func(ctx SpecContext) {
 			unreadyName := uniqueName("ttserver-unready")
 			unready := &terdutv1alpha1.TerdutServer{
 				ObjectMeta: metav1.ObjectMeta{Name: unreadyName, Namespace: operatorNamespace},
@@ -142,8 +156,7 @@ var _ = Describe("TerdutTeam Controller", func() {
 			DeferCleanup(func() { _ = k8sClient.Delete(ctx, unready) })

 			createTeam(ctx, "waiting", terdutv1alpha1.TerdutServerRef{Name: unreadyName})
-			reconcileOnce(ctx) // finalizer
-			reconcileOnce(ctx)
+			reconcileToReady(ctx)

 			Expect(readyCondition(ctx).Reason).To(Equal(terdutv1alpha1.ReasonWaitingForServer))
 		})
@@ -182,7 +195,7 @@ var _ = Describe("TerdutTeam Controller", func() {

 		It("permits when the TerdutServer's allowedTeams.namespaces.from is All", func(ctx SpecContext) {
 			Expect(k8sClient.Get(ctx, types.NamespacedName{Name: srv.Name, Namespace: operatorNamespace}, srv)).To(Succeed())
-			srv.Spec.AllowedTeams.Namespaces.From = "All"
+			srv.Spec.AllowedTeams.Namespaces.From = allNamespaces
 			Expect(k8sClient.Update(ctx, srv)).To(Succeed())

 			team := &terdutv1alpha1.TerdutTeam{
@@ -209,154 +222,292 @@ var _ = Describe("TerdutTeam Controller", func() {
 		})
 	})

-	Describe("adopt-on-409 recovery", func() {
-		It("adopts an already-created team instead of erroring", func(ctx SpecContext) {
+	Describe("team identity", func() {
+		It("refuses a name that belongs to a team this CR did not create", func(ctx SpecContext) {
 			fake.nextTeamID = 1
-			fake.teams["platform"] = 1
-			fake.teamNames[1] = "platform"
+			fake.teams[platformName] = 1
+			fake.teamNames[1] = platformName

-			createTeam(ctx, "platform", sameNSRef())
-			reconcileOnce(ctx) // finalizer
-			reconcileOnce(ctx)
+			createTeam(ctx, platformName, sameNSRef())
+			reconcileToReady(ctx)

-			team := &terdutv1alpha1.TerdutTeam{}
-			Expect(k8sClient.Get(ctx, teamKey, team)).To(Succeed())
-			Expect(team.Status.TeamID).To(Equal(int64(1)))
-			Expect(readyCondition(ctx).Status).To(Equal(metav1.ConditionTrue))
+			cond := readyCondition(ctx)
+			Expect(cond.Status).To(Equal(metav1.ConditionFalse))
+			Expect(cond.Reason).To(Equal(terdutv1alpha1.ReasonTeamNameTaken))
+			Expect(getTeam(ctx).Status.TeamID).To(BeZero())
+			Expect(fake.teamOIDC).To(BeEmpty(), "nothing is configured on a team that is not ours")
 		})

-		It("adopts an already-created team-scoped service account instead of erroring", func(ctx SpecContext) {
-			createTeam(ctx, "platform", sameNSRef())
-			reconcileOnce(ctx) // finalizer
+		It("keeps the same team when spec.displayName changes", func(ctx SpecContext) {
+			createTeam(ctx, platformName, sameNSRef())
+			reconcileToReady(ctx)
+			id := getTeam(ctx).Status.TeamID

-			// Pre-seed the service account the mint step is about to try to
-			// create, simulating an attempt that got this far before being
-			// interrupted.
-			fake.nextID = 1
-			saName := fmt.Sprintf("terdut-team.%s.%s", operatorNamespace, teamName)
-			fake.accounts[saName] = 1
-			fake.keyMints[1] = 1
+			team := getTeam(ctx)
+			team.Spec.DisplayName = "platform-renamed"
+			Expect(k8sClient.Update(ctx, team)).To(Succeed())
+			reconcileOnce(ctx)
+
+			Expect(getTeam(ctx).Status.TeamID).To(Equal(id))
+			Expect(fake.teamNames[id]).To(Equal("platform-renamed"))
+			Expect(fake.nextTeamID).To(Equal(id), "renamed in place, not recreated")
+		})
+
+		It("reports TeamNameTaken when a rename collides with another team", func(ctx SpecContext) {
+			createTeam(ctx, platformName, sameNSRef())
+			reconcileToReady(ctx)
+			fake.nextTeamID++
+			fake.teams["other"] = fake.nextTeamID
+			fake.teamNames[fake.nextTeamID] = "other"
+
+			team := getTeam(ctx)
+			team.Spec.DisplayName = "other"
+			Expect(k8sClient.Update(ctx, team)).To(Succeed())
+			reconcileOnce(ctx)
+
+			Expect(readyCondition(ctx).Reason).To(Equal(terdutv1alpha1.ReasonTeamNameTaken))
+		})
+
+		It("finds its team again when the status was lost", func(ctx SpecContext) {
+			createTeam(ctx, platformName, sameNSRef())
+			reconcileToReady(ctx)
+			id := getTeam(ctx).Status.TeamID
+
+			team := getTeam(ctx)
+			team.Status.TeamID = 0
+			Expect(k8sClient.Status().Update(ctx, team)).To(Succeed())
+			reconcileOnce(ctx)
+
+			Expect(getTeam(ctx).Status.TeamID).To(Equal(id))
+			Expect(fake.nextTeamID).To(Equal(id), "no second team was created")
+		})
+
+		It("recreates a team deleted behind its back", func(ctx SpecContext) {
+			createTeam(ctx, platformName, sameNSRef())
+			reconcileToReady(ctx)
+			id := getTeam(ctx).Status.TeamID
+			delete(fake.teams, platformName)
+			delete(fake.teamNames, id)
+			delete(fake.teamExt, operatorNamespace+"/"+teamName)

 			reconcileOnce(ctx)

+			Expect(getTeam(ctx).Status.TeamID).NotTo(Equal(id))
 			Expect(readyCondition(ctx).Status).To(Equal(metav1.ConditionTrue))
-			team := &terdutv1alpha1.TerdutTeam{}
-			Expect(k8sClient.Get(ctx, teamKey, team)).To(Succeed())
-			var credsSecret corev1.Secret
-			Expect(k8sClient.Get(ctx, types.NamespacedName{
-				Name: team.Status.CredentialsSecretRef.Name, Namespace: operatorNamespace,
-			}, &credsSecret)).To(Succeed())
-			// Minted fresh (mint2), not the pre-seeded account's original
-			// (never-issued-to-this-reconcile) key.
-			Expect(string(credsSecret.Data[credentialsSecretDataKey])).To(Equal("instance-key-1-mint2"))
 		})
 	})

-	Describe("spec.invite", func() {
-		It("mints a link into the TerdutTeam's own namespace, not the operator's", func(ctx SpecContext) {
-			createTeam(ctx, "platform", sameNSRef())
-			reconcileOnce(ctx) // finalizer
-			reconcileOnce(ctx) // create+mint+apply
+	Describe("spec.escalation", func() {
+		ladder := func() *terdutv1alpha1.EscalationSpec {
+			return &terdutv1alpha1.EscalationSpec{
+				RepeatCount: 2, FallbackTopic: "oncall",
+				Levels: []terdutv1alpha1.EscalationLevel{
+					{Timeout: "5m", Targets: []terdutv1alpha1.EscalationTarget{{Kind: terdutv1alpha1.EscalationTargetOncall}}},
+					{Timeout: "15m", Targets: []terdutv1alpha1.EscalationTarget{{Kind: terdutv1alpha1.EscalationTargetUser, Username: "alice"}}},
+				},
+			}
+		}
+		createWithLadder := func(ctx context.Context, e *terdutv1alpha1.EscalationSpec) {
+			Expect(k8sClient.Create(ctx, &terdutv1alpha1.TerdutTeam{
+				ObjectMeta: metav1.ObjectMeta{Name: teamName, Namespace: operatorNamespace},
+				Spec:       terdutv1alpha1.TerdutTeamSpec{ServerRef: sameNSRef(), DisplayName: platformName, Escalation: e},
+			})).To(Succeed())
+		}

-			team := &terdutv1alpha1.TerdutTeam{}
-			Expect(k8sClient.Get(ctx, teamKey, team)).To(Succeed())
-			team.Spec.Invite.Enabled = true
-			Expect(k8sClient.Update(ctx, team)).To(Succeed())
-			reconcileOnce(ctx)
+		It("PUTs the ladder with usernames for the server to resolve", func(ctx SpecContext) {
+			createWithLadder(ctx, ladder())
+			reconcileToReady(ctx)

-			Expect(k8sClient.Get(ctx, teamKey, team)).To(Succeed())
-			Expect(team.Status.InviteSecretRef).NotTo(BeNil())
-
-			var secret corev1.Secret
-			Expect(k8sClient.Get(ctx, types.NamespacedName{
-				Name: team.Status.InviteSecretRef.Name, Namespace: team.Namespace,
-			}, &secret)).To(Succeed())
-			Expect(string(secret.Data[inviteSecretURLKey])).To(ContainSubstring("invite="))
-			Expect(string(secret.Data[inviteSecretInviteIDKey])).To(Equal("1"))
-
-			inv := fake.invites[team.Status.TeamID][1]
-			Expect(inv.Role).To(Equal("member"), "default role")
-			Expect(inv.MaxUses).To(Equal(int64(1)), "default max uses")
+			got := fake.escalation[getTeam(ctx).Status.TeamID]
+			Expect(got.RepeatCount).To(Equal(int64(2)))
+			Expect(got.FallbackTopic).To(Equal("oncall"))
+			Expect(got.Levels).To(HaveLen(2))
+			Expect(got.Levels[0].TimeoutSeconds).To(Equal(int64(300)))
+			Expect(got.Levels[1].Targets[0]).To(Equal(tdclient.EscalationTargetRequest{Kind: "user", Username: "alice"}))
 		})

-		It("refreshes a link that's within a day of terdut-server's 7-day TTL", func(ctx SpecContext) {
-			createTeam(ctx, "platform", sameNSRef())
+		It("waits with UnknownUser while the server does not know a username", func(ctx SpecContext) {
+			fake.unknownUsers["alice"] = true
+			createWithLadder(ctx, ladder())
+			reconcileToReady(ctx)
+
+			cond := readyCondition(ctx)
+			Expect(cond.Reason).To(Equal(terdutv1alpha1.ReasonUnknownUser))
+			Expect(cond.Message).To(ContainSubstring("alice"))
+
+			delete(fake.unknownUsers, "alice")
 			reconcileOnce(ctx)
-			reconcileOnce(ctx)
-
-			team := &terdutv1alpha1.TerdutTeam{}
-			Expect(k8sClient.Get(ctx, teamKey, team)).To(Succeed())
-			team.Spec.Invite.Enabled = true
-			Expect(k8sClient.Update(ctx, team)).To(Succeed())
-			reconcileOnce(ctx)
-
-			Expect(k8sClient.Get(ctx, teamKey, team)).To(Succeed())
-			firstSecretName := team.Status.InviteSecretRef.Name
-			var secret corev1.Secret
-			Expect(k8sClient.Get(ctx, types.NamespacedName{Name: firstSecretName, Namespace: team.Namespace}, &secret)).To(Succeed())
-
-			// Simulate the stored link being within the refresh window of
-			// expiry, the way it genuinely would be six days from now,
-			// without the test waiting six days.
-			secret.Data[inviteSecretExpiresAtKey] = []byte(time.Now().Add(12 * time.Hour).Format(time.RFC3339)) // inside inviteRefreshWindow
-			Expect(k8sClient.Update(ctx, &secret)).To(Succeed())
-
-			reconcileOnce(ctx)
-
-			Expect(fake.inviteDelete[1]).To(BeTrue(), "the stale invite should have been revoked")
-			Expect(fake.invites[team.Status.TeamID]).To(HaveKey(int64(2)), "a replacement should have been minted")
+			Expect(readyCondition(ctx).Status).To(Equal(metav1.ConditionTrue))
 		})

-		It("revokes the invite when spec.invite.enabled flips back to false", func(ctx SpecContext) {
-			createTeam(ctx, "platform", sameNSRef())
-			reconcileOnce(ctx)
-			reconcileOnce(ctx)
+		It("clears the ladder when spec.escalation is removed", func(ctx SpecContext) {
+			createWithLadder(ctx, ladder())
+			reconcileToReady(ctx)

-			team := &terdutv1alpha1.TerdutTeam{}
-			Expect(k8sClient.Get(ctx, teamKey, team)).To(Succeed())
-			team.Spec.Invite.Enabled = true
+			team := getTeam(ctx)
+			team.Spec.Escalation = nil
 			Expect(k8sClient.Update(ctx, team)).To(Succeed())
 			reconcileOnce(ctx)

-			Expect(k8sClient.Get(ctx, teamKey, team)).To(Succeed())
-			secretName := team.Status.InviteSecretRef.Name
-			team.Spec.Invite.Enabled = false
+			Expect(fake.escalation[team.Status.TeamID].Levels).To(BeEmpty())
+		})
+
+		It("reports InvalidSpec for a duration that does not parse", func(ctx SpecContext) {
+			bad := ladder()
+			bad.Levels[0].Timeout = "5 minutes"
+			// The CRD pattern rejects it at admission when the API server enforces it;
+			// envtest does, so write it past the pattern by creating a valid one first.
+			bad.Levels[0].Timeout = "5m"
+			createWithLadder(ctx, bad)
+			reconcileToReady(ctx)
+			team := getTeam(ctx)
+			team.Spec.Escalation.Levels[0].Timeout = "0s"
 			Expect(k8sClient.Update(ctx, team)).To(Succeed())
 			reconcileOnce(ctx)

-			Expect(fake.inviteDelete[1]).To(BeTrue())
-			Expect(k8sClient.Get(ctx, teamKey, team)).To(Succeed())
-			Expect(team.Status.InviteSecretRef).To(BeNil())
+			Expect(readyCondition(ctx).Reason).To(Equal(terdutv1alpha1.ReasonInvalidSpec))
+		})
+	})

-			var secret corev1.Secret
-			err := k8sClient.Get(ctx, types.NamespacedName{Name: secretName, Namespace: team.Namespace}, &secret)
-			Expect(err).To(HaveOccurred(), "the invite Secret should have been deleted")
+	Describe("spec.deadmanSwitches", func() {
+		sw := func(name, matcher, timeout string) terdutv1alpha1.DeadmanSwitchSpec {
+			return terdutv1alpha1.DeadmanSwitchSpec{Name: name, Matcher: matcher, Timeout: timeout, Severity: "critical"}
+		}
+		setSwitches := func(ctx context.Context, switches ...terdutv1alpha1.DeadmanSwitchSpec) {
+			team := getTeam(ctx)
+			team.Spec.DeadmanSwitches = switches
+			Expect(k8sClient.Update(ctx, team)).To(Succeed())
+			reconcileOnce(ctx)
+		}
+		names := func(teamID int64) []string {
+			out := make([]string, 0, len(fake.switches[teamID]))
+			for _, s := range fake.switches[teamID] {
+				out = append(out, s.Name)
+			}
+			return out
+		}
+
+		It("creates, updates and prunes switches by name", func(ctx SpecContext) {
+			createTeam(ctx, platformName, sameNSRef())
+			reconcileToReady(ctx)
+			id := getTeam(ctx).Status.TeamID
+
+			setSwitches(ctx, sw("watchdog", "alertname=Watchdog", "15m"), sw("edge", "alertname=Edge", "5m"))
+			Expect(names(id)).To(ConsistOf("watchdog", "edge"))
+
+			// Same name, new timeout: updated in place, same id.
+			var watchdogID int64
+			for _, s := range fake.switches[id] {
+				if s.Name == "watchdog" {
+					watchdogID = s.ID
+				}
+			}
+			setSwitches(ctx, sw("watchdog", "alertname=Watchdog", "30m"))
+			Expect(names(id)).To(ConsistOf("watchdog"))
+			Expect(fake.switches[id][watchdogID].TimeoutSeconds).To(Equal(int64(1800)))
+			Expect(readyCondition(ctx).Status).To(Equal(metav1.ConditionTrue))
+		})
+
+		It("removes a switch somebody added on the server", func(ctx SpecContext) {
+			createTeam(ctx, platformName, sameNSRef())
+			reconcileToReady(ctx)
+			id := getTeam(ctx).Status.TeamID
+			fake.nextSwitchID++
+			fake.switches[id] = map[int64]tdclient.DeadmanSwitch{
+				fake.nextSwitchID: {ID: fake.nextSwitchID, Name: "stray", Matcher: "alertname=X", TimeoutSeconds: 60, Severity: "critical"},
+			}
+
+			reconcileOnce(ctx)
+
+			Expect(fake.switches[id]).To(BeEmpty())
+		})
+
+		It("recreates a switch deleted on the server", func(ctx SpecContext) {
+			createTeam(ctx, platformName, sameNSRef())
+			reconcileToReady(ctx)
+			id := getTeam(ctx).Status.TeamID
+			setSwitches(ctx, sw("watchdog", "alertname=Watchdog", "15m"))
+			fake.switches[id] = map[int64]tdclient.DeadmanSwitch{}
+
+			reconcileOnce(ctx)
+
+			Expect(names(id)).To(ConsistOf("watchdog"))
+		})
+
+		It("reports InvalidSpec for a timeout that does not parse", func(ctx SpecContext) {
+			createTeam(ctx, platformName, sameNSRef())
+			reconcileToReady(ctx)
+			setSwitches(ctx, sw("watchdog", "alertname=Watchdog", "0s"))
+
+			Expect(readyCondition(ctx).Reason).To(Equal(terdutv1alpha1.ReasonInvalidSpec))
 		})
 	})

 	Describe("deletion", func() {
-		It("deletes the team server-side and removes the credentials Secret", func(ctx SpecContext) {
+		It("deletes the team on the server and clears the finalizer", func(ctx SpecContext) {
 			createTeam(ctx, "to-delete", sameNSRef())
-			reconcileOnce(ctx)
-			reconcileOnce(ctx)
-			Expect(readyCondition(ctx).Status).To(Equal(metav1.ConditionTrue))
+			reconcileToReady(ctx)
+			teamID := getTeam(ctx).Status.TeamID

-			team := &terdutv1alpha1.TerdutTeam{}
-			Expect(k8sClient.Get(ctx, teamKey, team)).To(Succeed())
-			teamID := team.Status.TeamID
-			credsName := team.Status.CredentialsSecretRef.Name
-
-			Expect(k8sClient.Delete(ctx, team)).To(Succeed())
+			Expect(k8sClient.Delete(ctx, getTeam(ctx))).To(Succeed())
 			reconcileOnce(ctx) // runs the finalizer

 			Expect(fake.teamDelete[teamID]).To(BeTrue())
+			Expect(k8sClient.Get(ctx, teamKey, &terdutv1alpha1.TerdutTeam{})).NotTo(Succeed(),
+				"the TerdutTeam should be gone once the finalizer clears")
+		})

-			err := k8sClient.Get(ctx, teamKey, team)
-			Expect(err).To(HaveOccurred(), "the TerdutTeam itself should be gone once the finalizer clears")
+		It("still deletes the team after the server's allowedTeams consent is revoked", func(ctx SpecContext) {
+			otherNS := uniqueName("ns")
+			Expect(k8sClient.Create(ctx, &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: otherNS}})).To(Succeed())
+			DeferCleanup(func() { _ = k8sClient.Delete(ctx, &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: otherNS}}) })

-			var leftover corev1.Secret
-			err = k8sClient.Get(ctx, types.NamespacedName{Name: credsName, Namespace: operatorNamespace}, &leftover)
-			Expect(err).To(HaveOccurred(), "the team-credentials Secret should have been cleaned up")
+			Expect(k8sClient.Get(ctx, types.NamespacedName{Name: srv.Name, Namespace: operatorNamespace}, srv)).To(Succeed())
+			srv.Spec.AllowedTeams.Namespaces.From = allNamespaces
+			Expect(k8sClient.Update(ctx, srv)).To(Succeed())
+
+			crossKey := types.NamespacedName{Name: teamName, Namespace: otherNS}
+			Expect(k8sClient.Create(ctx, &terdutv1alpha1.TerdutTeam{
+				ObjectMeta: metav1.ObjectMeta{Name: teamName, Namespace: otherNS},
+				Spec: terdutv1alpha1.TerdutTeamSpec{
+					ServerRef:   terdutv1alpha1.TerdutServerRef{Name: srv.Name, Namespace: operatorNamespace},
+					DisplayName: "revoked",
+				},
+			})).To(Succeed())
+			for range 2 {
+				_, err := reconciler.Reconcile(ctx, reconcile.Request{NamespacedName: crossKey})
+				Expect(err).NotTo(HaveOccurred())
+			}
+			cross := &terdutv1alpha1.TerdutTeam{}
+			Expect(k8sClient.Get(ctx, crossKey, cross)).To(Succeed())
+			teamID := cross.Status.TeamID
+			Expect(teamID).NotTo(BeZero())
+
+			Expect(k8sClient.Get(ctx, types.NamespacedName{Name: srv.Name, Namespace: operatorNamespace}, srv)).To(Succeed())
+			srv.Spec.AllowedTeams.Namespaces.From = "None"
+			Expect(k8sClient.Update(ctx, srv)).To(Succeed())
+
+			Expect(k8sClient.Delete(ctx, cross)).To(Succeed())
+			_, err := reconciler.Reconcile(ctx, reconcile.Request{NamespacedName: crossKey})
+			Expect(err).NotTo(HaveOccurred())
+
+			Expect(fake.teamDelete[teamID]).To(BeTrue(), "revoking consent must not orphan the team")
+		})
+
+		It("lets the CR go when its TerdutServer is already gone", func(ctx SpecContext) {
+			createTeam(ctx, "to-delete", sameNSRef())
+			reconcileToReady(ctx)
+
+			serverKey := types.NamespacedName{Name: srv.Name, Namespace: operatorNamespace}
+			Expect(k8sClient.Get(ctx, serverKey, srv)).To(Succeed())
+			srv.Finalizers = nil
+			Expect(k8sClient.Update(ctx, srv)).To(Succeed())
+			Expect(k8sClient.Delete(ctx, srv)).To(Succeed())
+
+			Expect(k8sClient.Delete(ctx, getTeam(ctx))).To(Succeed())
+			reconcileOnce(ctx)
+
+			Expect(k8sClient.Get(ctx, teamKey, &terdutv1alpha1.TerdutTeam{})).NotTo(Succeed())
 		})
 	})
 })